MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4f99fb1aa34446d9a212fef85b747e1e69bd394e88665b76942d79dee1ac7ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4f99fb1aa34446d9a212fef85b747e1e69bd394e88665b76942d79dee1ac7ea
SHA3-384 hash: 63ca74da80b5e04fd071f0f3ebde77f2ce68f3902e9df9347c5288ef3eab58a93efa29bd451faa86d4c99c1feb24136b
SHA1 hash: b961c0a7bb80d9862061a24d2672da554efd01e5
MD5 hash: c1d258b9e14c9c2d0b7fe90c8db518b5
humanhash: steak-violet-massachusetts-red
File name:telnet
Download: download sample
Signature Mirai
Create hunting rule
File size:586 bytes
First seen:2025-10-21 15:46:25 UTC
Last seen:2025-10-22 00:22:52 UTC
File type: sh
MIME type:text/plain
ssdeep 12:tzwcKLHVoYkklUNNIl5KH0c0LKVHkvsle4pGNYVvGrA4aX:tSHeY76NNI7KUfKRbe48NG4y
TLSH T191F0F68FE16027478DD4FE8AF1734D885019E3CA28D25BDAFDDCA0BD41A8580F052B4A
Magika batch
Reporter abuse_ch
Tags:mirai sh
URLMalware sample (SHA256 hash)SignatureTags
http://23.177.185.39/armf6038ff963fc43473bd69ee8b571b6bcdc88d7bb3231ec5727e835232edee6a7 Miraielf mirai ua-wget
http://23.177.185.39/arm5b5f97c4c0ff408de365da6735bf940d1a6a7f7465be68509db8e313f3dcf174f Miraielf gafgyt mirai ua-wget
http://23.177.185.39/arm6625c60b9a8b0347d5a3988d73bf19d9c5bc9bf126fa8720dd28c648edb4a0975 Miraielf gafgyt mirai ua-wget
http://23.177.185.39/arm7ffe536b3d11dd297b8155ecf55695ef88518cc6e35976efed155b6328444bfb5 Miraielf mirai ua-wget
http://23.177.185.39/mips2cae01a9c5ccb06c91d94ba45a9aaec9f804f60f9bf86cdf97daf5ceacae8f4f Mirai32-bit elf gafgyt mirai Mozi
http://23.177.185.39/mpsl9b9764585122f6e0d842fb301963fed0cb6cba5a12740fec2c660d1f636bafd5 Miraielf gafgyt mirai ua-wget
http://23.177.185.39/x8637429b16ecb491e691262e8531d59c19386077c257ea0c703401cf48fdbf9da1 Miraielf gafgyt mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
49
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/68f7ab183a79800405eebc0b/reports/bc389c26-892e-42aa-8501-3b1a0634dfec/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-10-21T13:10:00Z UTC
Last seen:
2025-10-22T10:13:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b4f99fb1aa34446d9a212fef85b747e1e69bd394e88665b76942d79dee1ac7ea/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2d195cc8-91c6-42fb-8888-7d47a0bae77c
Behavior Graph:
Download SVG
%3 guuid=d4865af0-1700-0000-53db-21fa6c0c0000 pid=3180 /usr/bin/sudo guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184 /tmp/sample.bin guuid=d4865af0-1700-0000-53db-21fa6c0c0000 pid=3180->guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184 execve guuid=a6d558f2-1700-0000-53db-21fa710c0000 pid=3185 /usr/bin/mkdir guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=a6d558f2-1700-0000-53db-21fa710c0000 pid=3185 execve guuid=73b803f3-1700-0000-53db-21fa730c0000 pid=3187 /usr/bin/wget net send-data guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=73b803f3-1700-0000-53db-21fa730c0000 pid=3187 execve guuid=072b9a05-1800-0000-53db-21fa840c0000 pid=3204 /usr/bin/chmod guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=072b9a05-1800-0000-53db-21fa840c0000 pid=3204 execve guuid=e2ef3d06-1800-0000-53db-21fa850c0000 pid=3205 /usr/bin/dash guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=e2ef3d06-1800-0000-53db-21fa850c0000 pid=3205 clone guuid=34957206-1800-0000-53db-21fa860c0000 pid=3206 /usr/bin/rm guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=34957206-1800-0000-53db-21fa860c0000 pid=3206 execve guuid=1aaac806-1800-0000-53db-21fa870c0000 pid=3207 /usr/bin/wget net send-data write-file guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=1aaac806-1800-0000-53db-21fa870c0000 pid=3207 execve guuid=fce9b133-1800-0000-53db-21fac00c0000 pid=3264 /usr/bin/chmod guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=fce9b133-1800-0000-53db-21fac00c0000 pid=3264 execve guuid=595f2234-1800-0000-53db-21fac10c0000 pid=3265 /usr/bin/dash guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=595f2234-1800-0000-53db-21fac10c0000 pid=3265 clone guuid=524bd634-1800-0000-53db-21fac50c0000 pid=3269 /usr/bin/rm guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=524bd634-1800-0000-53db-21fac50c0000 pid=3269 execve guuid=1b488635-1800-0000-53db-21fac80c0000 pid=3272 /usr/bin/wget net send-data write-file guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=1b488635-1800-0000-53db-21fac80c0000 pid=3272 execve guuid=ba35bf62-1800-0000-53db-21fa040d0000 pid=3332 /usr/bin/chmod guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=ba35bf62-1800-0000-53db-21fa040d0000 pid=3332 execve guuid=51bf4963-1800-0000-53db-21fa050d0000 pid=3333 /usr/bin/dash guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=51bf4963-1800-0000-53db-21fa050d0000 pid=3333 clone guuid=30b42b64-1800-0000-53db-21fa080d0000 pid=3336 /usr/bin/rm guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=30b42b64-1800-0000-53db-21fa080d0000 pid=3336 execve guuid=086a8d64-1800-0000-53db-21fa0a0d0000 pid=3338 /usr/bin/wget net send-data write-file guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=086a8d64-1800-0000-53db-21fa0a0d0000 pid=3338 execve guuid=77a53290-1800-0000-53db-21fa6a0d0000 pid=3434 /usr/bin/chmod guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=77a53290-1800-0000-53db-21fa6a0d0000 pid=3434 execve guuid=ec736d90-1800-0000-53db-21fa6b0d0000 pid=3435 /usr/bin/dash guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=ec736d90-1800-0000-53db-21fa6b0d0000 pid=3435 clone guuid=9869fe90-1800-0000-53db-21fa6f0d0000 pid=3439 /usr/bin/rm guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=9869fe90-1800-0000-53db-21fa6f0d0000 pid=3439 execve guuid=96433c91-1800-0000-53db-21fa710d0000 pid=3441 /usr/bin/wget net send-data write-file guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=96433c91-1800-0000-53db-21fa710d0000 pid=3441 execve guuid=a023a1c4-1800-0000-53db-21fadd0d0000 pid=3549 /usr/bin/chmod guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=a023a1c4-1800-0000-53db-21fadd0d0000 pid=3549 execve guuid=669822c5-1800-0000-53db-21fade0d0000 pid=3550 /usr/bin/dash guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=669822c5-1800-0000-53db-21fade0d0000 pid=3550 clone guuid=c2d89dc6-1800-0000-53db-21fae30d0000 pid=3555 /usr/bin/rm guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=c2d89dc6-1800-0000-53db-21fae30d0000 pid=3555 execve guuid=72fad3c6-1800-0000-53db-21fae50d0000 pid=3557 /usr/bin/wget net send-data write-file guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=72fad3c6-1800-0000-53db-21fae50d0000 pid=3557 execve guuid=52c365fa-1800-0000-53db-21fa280e0000 pid=3624 /usr/bin/chmod guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=52c365fa-1800-0000-53db-21fa280e0000 pid=3624 execve guuid=029ab1fa-1800-0000-53db-21fa2a0e0000 pid=3626 /usr/bin/dash guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=029ab1fa-1800-0000-53db-21fa2a0e0000 pid=3626 clone guuid=cbd56afc-1800-0000-53db-21fa320e0000 pid=3634 /usr/bin/rm guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=cbd56afc-1800-0000-53db-21fa320e0000 pid=3634 execve guuid=3969a1fc-1800-0000-53db-21fa340e0000 pid=3636 /usr/bin/wget net send-data write-file guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=3969a1fc-1800-0000-53db-21fa340e0000 pid=3636 execve guuid=38d02b29-1900-0000-53db-21fa900e0000 pid=3728 /usr/bin/chmod guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=38d02b29-1900-0000-53db-21fa900e0000 pid=3728 execve guuid=5b318429-1900-0000-53db-21fa920e0000 pid=3730 /tmp/1/x86 guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=5b318429-1900-0000-53db-21fa920e0000 pid=3730 execve guuid=8b62cc2b-1900-0000-53db-21fa9e0e0000 pid=3742 /usr/bin/rm guuid=754d1cf2-1700-0000-53db-21fa700c0000 pid=3184->guuid=8b62cc2b-1900-0000-53db-21fa9e0e0000 pid=3742 execve ba55188c-1d8c-531d-84cb-0b022f7a1844 23.177.185.39:80 guuid=73b803f3-1700-0000-53db-21fa730c0000 pid=3187->ba55188c-1d8c-531d-84cb-0b022f7a1844 send: 131B guuid=1aaac806-1800-0000-53db-21fa870c0000 pid=3207->ba55188c-1d8c-531d-84cb-0b022f7a1844 send: 132B guuid=1b488635-1800-0000-53db-21fac80c0000 pid=3272->ba55188c-1d8c-531d-84cb-0b022f7a1844 send: 132B guuid=086a8d64-1800-0000-53db-21fa0a0d0000 pid=3338->ba55188c-1d8c-531d-84cb-0b022f7a1844 send: 132B guuid=96433c91-1800-0000-53db-21fa710d0000 pid=3441->ba55188c-1d8c-531d-84cb-0b022f7a1844 send: 132B guuid=72fad3c6-1800-0000-53db-21fae50d0000 pid=3557->ba55188c-1d8c-531d-84cb-0b022f7a1844 send: 132B guuid=3969a1fc-1800-0000-53db-21fa340e0000 pid=3636->ba55188c-1d8c-531d-84cb-0b022f7a1844 send: 131B guuid=0f7a792b-1900-0000-53db-21fa990e0000 pid=3737 /tmp/1/ zombie guuid=5b318429-1900-0000-53db-21fa920e0000 pid=3730->guuid=0f7a792b-1900-0000-53db-21fa990e0000 pid=3737 clone guuid=d3e97e2b-1900-0000-53db-21fa9a0e0000 pid=3738 /tmp/1/ delete-file zombie guuid=5b318429-1900-0000-53db-21fa920e0000 pid=3730->guuid=d3e97e2b-1900-0000-53db-21fa9a0e0000 pid=3738 clone guuid=2a028e2b-1900-0000-53db-21fa9c0e0000 pid=3740 /tmp/1/ dns net send-data zombie guuid=5b318429-1900-0000-53db-21fa920e0000 pid=3730->guuid=2a028e2b-1900-0000-53db-21fa9c0e0000 pid=3740 clone 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=2a028e2b-1900-0000-53db-21fa9c0e0000 pid=3740->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 38B 54d92a3b-1447-55af-b534-047898c60c8d 1.1.1.1:53 guuid=2a028e2b-1900-0000-53db-21fa9c0e0000 pid=3740->54d92a3b-1447-55af-b534-047898c60c8d send: 38B 2844b080-1db0-5ca3-8ce1-cd8cd5996747 bot.federalagent.xyz:13422 guuid=2a028e2b-1900-0000-53db-21fa9c0e0000 pid=3740->2844b080-1db0-5ca3-8ce1-cd8cd5996747 send: 13B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b4f99fb1aa34446d9a212fef85b747e1e69bd394e88665b76942d79dee1ac7ea
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4f99fb1aa34446d9a212fef85b747e1e69bd394e88665b76942d79dee1ac7ea/
Threat name:
Linux.Worm.Mirai
Create hunting rule
Status:
Malicious
First seen:
2025-10-21 15:33:51 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wt4z7mnkgrcg3grbf7xyln2h4htjxu4u5cdgln3jillz33q2y7va._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251021-taaetscq7w/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b4f99fb1aa34446d9a212fef85b747e1e69bd394e88665b76942d79dee1ac7ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh b4f99fb1aa34446d9a212fef85b747e1e69bd394e88665b76942d79dee1ac7ea

(this sample)

Mirai

elf 044751d86829a914b19e0243c9d3297081a5774ea48badc6c272701d7a1ffb12

  
URLhaus
https://urlhaus.abuse.ch/url/3683042/
  
Delivery method
Distributed via web download
  
Dropping
MD5 8bc462f18dfed358fa7a5fa743144ade
  
Dropping
SHA256 044751d86829a914b19e0243c9d3297081a5774ea48badc6c272701d7a1ffb12

Comments